/**
 * kubectl-context.ts — shared kubectl-context resolver.
 *
 * Single source of truth for the D1 / SEC-NEW-003 context-resolution
 * policy. Extracted so `upgrade-kubernetes.ts`, `auth-refresh-kubernetes.ts`,
 * `services.ts`, and any future kubernetes-substrate consumer can call the
 * same helper instead of duplicating it.
 *
 * Policy (matches the pre-existing auth-refresh-kubernetes.ts and services.ts
 * behaviour — see also docs/architecture/peripheral-services-on-k3s.md):
 *
 *   1. `host.kubectl_context_pinned` in `~/.olam/config.json` (preferred,
 *      persistent — the doc-recommended way).
 *   2. `OLAM_K8S_CONTEXT_ACK` env var (deprecated fallback; emits a
 *      deprecation warning to nudge operators toward (1)).
 *   3. Both absent → error result with actionable remediation.
 *
 * No `fs` reads in this module beyond what `readConfig` does; no kubectl
 * invocations. Pure resolution. Safe to call from any layer.
 */
import { readConfig } from './config.js';
const DEPRECATION_WARNING = 'OLAM_K8S_CONTEXT_ACK is deprecated; set host.kubectl_context_pinned in ~/.olam/config.json';
const NO_CONTEXT_ERROR = 'kubectl_context_pinned is not set in ~/.olam/config.json and OLAM_K8S_CONTEXT_ACK is not set.\n' +
    '  Set host.kubectl_context_pinned in ~/.olam/config.json to your kubectl context name.';
/**
 * Resolve the operator's kubectl context name. See module docstring for policy.
 *
 * `configPath` lets callers (and tests) point at a non-default config file.
 * Returns a `KubectlContextResolution` — callers branch on `error` vs `context`.
 */
export function resolveKubectlContext(configPath) {
    const cfg = readConfig({ configPath });
    const raw = cfg.host['kubectl_context_pinned'];
    if (typeof raw === 'string' && raw.length > 0) {
        return { context: raw };
    }
    const ack = process.env['OLAM_K8S_CONTEXT_ACK'];
    if (typeof ack === 'string' && ack.length > 0) {
        return { context: ack, deprecationWarning: DEPRECATION_WARNING };
    }
    return { error: NO_CONTEXT_ERROR };
}
//# sourceMappingURL=kubectl-context.js.map